What a good booking flow asks, and what it leaves out
A booking flow has one job: turn a person who has decided to book into a confirmed appointment, with the least effort on both sides. Many booking flows go wrong by asking too much, too early, or in the wrong order.
A flow that works for most general, allied health and aesthetics clinics follows four steps. Each step should make sense on a phone, show where the patient is up to, and let them go back without losing what they entered.
- 01
1. Service
Start with what the patient wants, in their words: a check-up, an initial consultation, a follow-up. The service sets the appointment length, so it has to come first.
- 02
2. Practitioner (optional)
Let patients choose a practitioner or pick "first available". Returning patients often want the same person; new patients usually want the soonest time.
- 03
3. Date and time
Show real availability from your practice management or booking system. A request form that promises a call back is a different product, and the page should say so plainly.
- 04
4. Details and confirmation
Name, mobile, email, and whether they are a new patient. Ask for anything else only if the appointment cannot go ahead without it, and put detailed health history in an intake form after the booking, sent securely.
Where booking pages meet Ahpra's advertising rules
A clinic website is advertising. Ahpra's Guidelines for advertising a regulated health service, which took effect on 14 December 2020, cover electronic communication that promotes a regulated health service, including websites and social media. Booking pages, service pages and the text on your "Book now" buttons all count.
The core rules sit in section 133 of the National Law. Ahpra's page on advertising and the law lists five things advertising must not do: be false, misleading or deceptive; offer a gift, discount or other inducement without stating its terms and conditions; use testimonials or purported testimonials; create an unreasonable expectation of beneficial treatment; or directly or indirectly encourage indiscriminate or unnecessary use of health services. The same page gives maximum penalties of $60,000 per offence for an individual and $120,000 for a body corporate.
On a booking page this usually comes down to three things. Any offer (a new patient price, a free consultation) needs its terms written next to it. Treatment descriptions should describe what happens, not promise an outcome. And urgency devices such as countdown timers and scarcity banners deserve a hard look, because they push people to book a health service faster than they otherwise would.
Testimonials and reviews on your own website
Ahpra's testimonial guidance defines a testimonial as a recommendation or positive statement about the clinical aspects of a service. A statement is clinical when it mentions the symptom or reason for seeking treatment, the diagnosis or treatment, or the outcome or the practitioner's skill. Comments only about customer service or communication style are not testimonials.
That distinction matters for booking pages, which often carry a review widget. A comment about friendly reception or easy parking is fine. A comment that names a symptom, a treatment or a result is a testimonial and cannot be used in your advertising. The same guidance says you are responsible for testimonials on platforms you control, such as your website and your business social media pages, but not for removing them from platforms you do not control, such as Google reviews. It also warns that selectively editing reviews can itself be misleading.
The practical answer is to stop embedding live review feeds you cannot filter, and to publish only comments you have read and checked against the guidance.
Before-and-after images
Ahpra's general advertising guidelines do not set out a specific rule for before-and-after photos, but any image is still subject to section 133: it must not mislead or create an unreasonable expectation of benefit. For cosmetic work the rules are specific and strict.
The guidelines for advertising higher risk non-surgical cosmetic procedures, which Ahpra announced as taking effect on 2 September 2025, cover procedures such as dental veneers, botulinum toxin injections and dermal fillers. Images must be genuine images of actual patients, must not be edited or enhanced, must be as similar as possible in lighting, angle, background, framing, posture, clothing and makeup, and must carry a prominent warning that results are only relevant to that patient. Testimonials are not allowed in this advertising at all, and images of people under 18 must not be used.
Medical practitioners who advertise cosmetic surgery have their own Medical Board guidelines, in effect from 1 July 2023, with similar rules on genuine, unedited, consistent images. If your booking flow shows a gallery, treat each image as a claim that needs to meet the relevant guideline.
Privacy basics for booking forms
Many small businesses are exempt from the Privacy Act. Clinics are not. The OAIC's small business guidance says that regardless of turnover, the Privacy Act covers any business that is a health service provider. The OAIC's Guide to health privacy adds that health information is sensitive information, which carries stricter requirements.
For a booking form, four of the Australian Privacy Principles do most of the work. Under APP 3, collect only what is reasonably necessary, and get consent for sensitive information unless an exception applies. Under APP 5, tell people at or before the time you collect their information who you are, why you are collecting it, who you usually disclose it to, and that your privacy policy explains how they can access or correct it and how to complain. A short collection notice above the submit button does this. The OAIC's health practice guidance covers APP 1 (a clear, current privacy policy, available free, for example on your website) and APP 11 (reasonable steps to protect information, including when third-party or cloud providers hold it).
That last point covers your booking software. If a third-party platform stores the booking, it is part of how you protect patient information, so check where it stores data and who can access it. If something does go wrong, the Notifiable Data Breaches scheme requires you to assess a suspected breach within 30 calendar days and, if it is likely to result in serious harm, notify the OAIC and affected people as soon as practicable.
Tracking pixels on booking pages
Booking pages are where marketing tools and health information collide. The OAIC's guidance on tracking pixels and privacy obligations, published in November 2024, says pixels should be configured to avoid collecting sensitive information, and that sensitive information should only be collected through a pixel with a person's express consent.
In June 2026 the Privacy Commissioner found that two health businesses breached the Privacy Act by using third-party tracking pixels on health-related websites and then targeting visitors with social media ads without consent. For clinics, the safe default is simple: no advertising pixels on booking, intake or treatment-specific confirmation pages unless you have consent and have checked exactly what each pixel sends. Measure bookings with a conversion that carries no health details instead.
A practical checklist
This is general information, not legal advice. If a claim or image is borderline, check it with Ahpra's resources or your professional indemnity insurer before it goes live.
- 01
Four steps, phone first
Service, practitioner, time, details. Test the whole flow on a phone with a slow connection.
- 02
Collect the minimum
Keep the booking form to what the appointment needs. Move health history into a secure intake step after booking.
- 03
Collection notice and privacy policy
A short notice above the submit button, linked to a current privacy policy that names your booking provider.
- 04
Offers with terms
Any price, discount or free consultation has its conditions written next to it.
- 05
No clinical testimonials
Remove unfiltered review feeds. Keep only comments about service and communication.
- 06
Images checked against the right guideline
Cosmetic images meet the non-surgical or cosmetic surgery guidelines, with the required warning.
- 07
Pixels off sensitive pages
No advertising pixels on booking, intake or treatment confirmation pages without consent. Review what each tag sends.
- 08
A breach plan
Know who assesses a suspected breach, and how you would notify the OAIC and patients.
Conclusion
A good clinic booking flow is short, honest and careful with information. Ask for what the appointment needs, say why you are collecting it, keep testimonials and images inside Ahpra's rules, and keep advertising pixels away from pages that reveal health information. Our clinic Launch Kits start from these ideas: Lumina Dental has a booking flow that settles the service, practitioner and time before it asks for details and Aethel has a consultation request flow with a discreet intake form, and our health and wellness work covers the rest of the site. If you want us to review your current booking flow, get in touch.
Common questions
Ahpra's testimonial guidance says reviews that mention clinical aspects (symptoms, treatment, outcomes or a practitioner's skill) are testimonials and cannot be used in advertising. Comments only about customer service or communication are fine. An unfiltered live feed can pull in clinical reviews, so a checked, curated selection is safer.
Yes. The OAIC says the Privacy Act covers any business that is a health service provider, regardless of turnover, and health information is sensitive information under the Act.
Not in general, but they must not mislead or create an unreasonable expectation of benefit. For higher risk non-surgical cosmetic procedures and for cosmetic surgery, Ahpra and the Medical Board set specific rules: genuine, unedited, consistent images with a prominent warning, and no images of people under 18 for higher risk non-surgical cosmetic procedures.
Be very careful. The OAIC says sensitive information should only be collected through a tracking pixel with express consent, and in June 2026 the Privacy Commissioner found two health businesses breached the Privacy Act through tracking pixels. The safer approach is no advertising pixels on booking or intake pages without consent, and a conversion signal that contains no health details.
Sources
- Guidelines for advertising a regulated health service. Ahpra. Accessed .
- Advertising and the law. Ahpra. Accessed .
- Testimonials: understand the requirements. Ahpra. Accessed .
- Advertising higher risk non-surgical cosmetic procedures. Ahpra. Accessed .
- Putting patients first: new guidelines for cosmetic procedures. Ahpra. Accessed .
- Guidelines for registered medical practitioners who advertise cosmetic surgery. Medical Board of Australia. Accessed .
- Small business. Office of the Australian Information Commissioner. Accessed .
- Guide to health privacy: introduction and key concepts. Office of the Australian Information Commissioner. Accessed .
- Chapter 3: APP 3 Collection of solicited personal information. Office of the Australian Information Commissioner. Accessed .
- Chapter 5: APP 5 Notification of the collection of personal information. Office of the Australian Information Commissioner. Accessed .
- Chapter 1: Key steps to embedding privacy in your health practice. Office of the Australian Information Commissioner. Accessed .
- Part 4: Notifiable Data Breach (NDB) Scheme. Office of the Australian Information Commissioner. Accessed .
- Tracking pixels and privacy obligations. Office of the Australian Information Commissioner. Accessed .
- Privacy Commissioner finds privacy breaches in third-party tracking pixel investigation. Office of the Australian Information Commissioner. Accessed .
Tags: Clinic websitesOnline bookingAhpraHealth advertisingPrivacy ActAustralian Privacy PrinciplesTracking pixels